#414 Add VaultAnnotationProvider support to @swamp/aws-sm

Problem

swamp now supports first-class vault annotations via swamp vault annotate and swamp vault inspect (swamp-club#412, PR #1434). The VaultAnnotationProvider interface allows vault providers to store metadata (URL, notes, labels) alongside secrets. The built-in local_encryption provider already implements it.

The @swamp/aws-sm extension does not yet implement VaultAnnotationProvider, so swamp vault annotate returns an error for AWS Secrets Manager vaults.

Proposed solution

Implement VaultAnnotationProvider on the AWS Secrets Manager vault provider:

• notes → AWS Secrets Manager Description field on the secret
• labels → AWS resource tags (key-value pairs)
• url → stored as a tag (e.g. swamp:url)

The createProvider factory should return an object implementing both VaultProvider and VaultAnnotationProvider. No schema or adapter changes needed — swamp detects annotation support at runtime via duck typing.

Alternatives considered

None — this is the natural extension of the core annotation feature to the AWS backend.